PR for keywordlabeler
![](https://secure.gravatar.com/avatar/96dd777e397ab128fedab46af97a3a4a.jpg?s=120&d=mm&r=g)
Hi All, There is a pending PR <https://github.com/numpy/numpy/pull/19198> that uses keywordlabeler <https://github.com/marketplace/keywordlabeler> to automatically label PRs and issues. Installing the app requires giving it write permissions to PRs and issues. This isn't different than with the current labeler, but I note that we don't have a procedure for deciding such issues that may have security implications. So I am posting here before proceeding with app installation. Thoughts? Chuck
![](https://secure.gravatar.com/avatar/72f994ca072df3a3d2c3db8a137790fd.jpg?s=120&d=mm&r=g)
On 10/6/21 10:20 pm, Charles R Harris wrote:
Hi All,
There is a pending PR <https://github.com/numpy/numpy/pull/19198> that uses keywordlabeler <https://github.com/marketplace/keywordlabeler> to automatically label PRs and issues. Installing the app requires giving it write permissions to PRs and issues. This isn't different than with the current labeler, but I note that we don't have a procedure for deciding such issues that may have security implications. So I am posting here before proceeding with app installation.
Thoughts?
Chuck
If there was a way to pin these actions to a hash tag that would be better, at the least it should pin to a version. We already use third party actions in the github workflow: checkout and setup-python (both specifying a "version" via "@v2"), larsoner/circleci-artifacts-redirector-action@master (hmm, that should pin to a version). Matti
participants (2)
-
Charles R Harris
-
Matti Picus